gateway: file nginx error lines at their own severity

Filtering the gateway's journal by severity returned nothing while nginx
was logging [error] continuously. Measured against nginx.service:
`-p warning` and `-p err` over 24h both said "No entries", while the
unfiltered query returned a continuous stream of [error] lines.

The failure is inverted rather than merely missing. A severity filter is
how you ask "is anything wrong", and here it answered "no" *because* the
errors were misfiled -- one step from recording "gateway clean, no
warnings in 24h".

Cause: the module default is `error_log stderr`, and systemd files that
whole stream at one priority regardless of what each line says. Routing
to syslog preserves per-line severity, so [error] lands as err and every
existing severity filter starts working without changing a consumer.

Uses the module's own `logError` option rather than appendConfig:
nixpkgs emits `error_log ${cfg.logError};` at exactly one site, in the
main context, so the option guarantees the placement. Transport only --
no level suffix, so nginx keeps its default `error` threshold and this
changes where lines are filed, not which lines exist.

Gated with `nginx -t` on the flake-locked nginx against the exact string
shipped here, with a deliberately invalid syslog target as the control
that the test can fail on this directive. gixy (what the module's own
validateConfigFile actually runs) reports no issues.

What that does NOT prove: that journald files the lines at the right
severity. `nginx -t` is a parse check; only a deploy shows the effect.

nix/host-modules/hive-gateway/default.nix

@@ -385,6 +385,19 @@ in
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       inherit (nginxTree) virtualHosts;
+
+      # Route the error log through syslog so each line keeps its own
+      # severity. The module default is `stderr`, and systemd files that
+      # whole stream at one priority regardless of what each line says —
+      # so `journalctl -p err -u nginx` returns nothing while nginx is
+      # logging `[error]` continuously. That failure is inverted rather
+      # than merely missing: a severity filter is how you ask "is anything
+      # wrong", and it answers "no" *because* the errors are misfiled.
+      #
+      # Transport only — no level suffix, so nginx keeps its default
+      # `error` threshold and this changes where lines are filed, not
+      # which lines exist.
+      logError = "syslog:server=unix:/dev/log,nohostname,tag=nginx";
     };
 
     # ⚠️ NO `SupplementaryGroups = [ "hive-core" ]` on nginx, and its